Cybersecurity Tools · free · no sign-up
JWT Decoder
Read the contents of a JSON Web Token (JWT).
JWT Decoder
Decode and view JSON Web Token Header and Payload data securely.
About the JWT Decoder
Read the contents of a JSON Web Token (JWT).
How to use the JWT Decoder
- Paste your token or click Sample.
- Press Process / Generate to see the header and payload.
- Use Copy or Download.
When to use the JWT Decoder
- Reading the claims inside a token while you debug a login or an API problem.
- Checking when a token was issued and when it expires.
- Confirming which user, role or scope a token carries.
- Learning how a JSON Web Token is put together.
Common mistakes to avoid
- Believing that a decoded token is a verified token. Anyone can create a token with any content, so only checking the signature on your server proves it is genuine.
- Putting sensitive data such as passwords in the payload. The payload is only encoded, so anybody who has the token can read it.
- Pasting live production tokens into online tools. Use test tokens, or revoke a token you pasted.
Tips
- A JWT payload is only encoded, not encrypted, so anyone can read it. Never put secrets inside.
- Decoding does not prove that a token is genuine.
- Do not paste live production tokens into online tools.
- Check the exp claim to see whether the token is still valid.
- Keep token lifetimes short and use refresh tokens for long sessions.
Frequently asked questions
What are the three parts of a JWT?
The header, the payload and the signature, separated by dots.
What are the three parts of a JWT?
The header (the algorithm and type), the payload (the claims) and the signature, separated by dots.
Is a JWT encrypted?
A standard signed JWT is not encrypted. It is Base64URL-encoded, so its contents can be read by anyone.
What does exp mean?
The expiry time of the token, given as a Unix timestamp in seconds.